# Why do bots attack the password reset page instead of the login page? | BondProof

Source: https://bondproof.com/blog/2026-11-12-password-reset-abuse-bots.html

[Home](../index.md) / [Blog](index.md)


November 12, 2026 - BondProof

**Short answer:** Bots attack the reset page because it is less guarded than the login page and it answers a question the login page will not: whether an email address has an account. A reset request that says account not found tells the bot the address is dead, and a request that sends an email tells the bot the address is live. That list is the starting point for the credential stuffing campaign that follows.

## The reset page answers a question the login page will not

A login page says the same thing whether the account exists or not: invalid credentials. That silence is deliberate, because telling an attacker which usernames are real would hand them half the attack. The reset page is supposed to say the same thing, and many do not. A reset form that replies account not found for one address and a reset link has been sent for another is an oracle, and the bot asks it a thousand questions an hour.

The enumeration is the first of four patterns OWASP names in its Forgot Password Cheat Sheet: enumeration, flooding, token theft, and weak recovery. Enumeration is the quietest, because nothing fails and nothing is stolen. The bot simply learns which addresses have accounts, and the list it builds is the target list for the next attack.

The scale is not small. LexisNexis found that one in four desktop password reset attempts is fraud, and bot-based reset attacks rose 1,680 percent in one measured period, with detail-change attacks up 232 percent in 2023. The reset page is not a side door. For a large share of attackers it is the front door.

## Flooding: the reset email as a weapon

The second pattern is flooding. The bot requests a reset for the same address hundreds of times, and the victim's inbox fills with reset emails. The flood is the attack, not the prelude: a victim who cannot find the real security alert in a hundred reset emails misses the alert that matters.

The flood also punishes the sender. A burst of reset emails from your domain to one address looks like spam to the receiving provider, and the provider starts treating your mail as spam. The bot does not need to break into the account to hurt you. It needs your own reset emails to do the damage.

The defence is the rate limit, and it has to be keyed to the address, not the IP. A bot that rotates IPs defeats an IP limit in seconds, and the address limit is the one that actually stops the flood.

## Token theft and the weak recovery question

The third pattern is token theft. A reset link is a bearer token: whoever holds it owns the account. A token that lives too long, that is sent over an insecure channel, or that is guessable is a password in another form. A token that expires in fifteen minutes and works once is a different thing from a token that works for a day and can be reused.

The fourth pattern is the weak recovery question. A mother's maiden name, a first pet, a hometown: all of it is in the victim's social media, or in a data breach, or in a public record. A recovery question that can be answered from a search is not a security control. It is a quiz with the answers published.

## The reset page deserves the same locks as the login page

Give the reset page the same treatment as the login page: a bot challenge, a rate limit keyed to the address, and the same response whether the account exists or not. The user experience cost is zero, because a real user who mistypes their address gets the same message either way, and checks their inbox either way.

Shorten the token lifetime, make the token single-use, and send it only to the address on file. Never show a different page for an existing account, and never confirm an address is live by sending a different email.

And retire the recovery questions. A second factor, an authenticator app or a hardware key, is the replacement, and it is the one the attacker cannot answer from a search.

Keep reading: [How do bots exploit buy-online-pickup-in-store to move stolen cards?](https://bondproof.com/blog/2026-11-11-bopis-pickup-fraud-bots.md), [The one-dollar hold: why test charges show up on real customers' statements](https://bondproof.com/blog/2026-11-10-one-dollar-authorization-hold-card-testing.md), and [How does triangulation fraud use real shoppers to hide stolen card orders?](https://bondproof.com/blog/2026-10-19-triangulation-fraud-retail.md) cover the nearby cases in this series.

## Frequently asked questions

### Why is the password reset page a target for bots?

Because it answers a question the login page will not: whether an email address has an account. A reset form that says account not found for one address and sends a link for another hands the bot a list of live accounts to attack next.

### What is password reset flooding?

A bot requests a reset for the same address hundreds of times, filling the victim's inbox with reset emails so the real security alert gets buried. It also hurts the sender, because a burst of reset emails makes providers treat your mail as spam.

### How long should a reset link stay valid?

As short as practical, fifteen minutes is the common recommendation, and it should work exactly once. A token that lives for a day and can be reused is a password in another form.

### Should I still use security questions for account recovery?

No. A mother's maiden name or a first pet is in the victim's social media or a data breach. Use a second factor, an authenticator app or a hardware key, instead of a question with a published answer.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)